Add new features and tests for AirGap and Time modules

- Introduced `SbomService` tasks documentation.
- Updated `StellaOps.sln` to include new projects: `StellaOps.AirGap.Time` and `StellaOps.AirGap.Importer`.
- Added unit tests for `BundleImportPlanner`, `DsseVerifier`, `ImportValidator`, and other components in the `StellaOps.AirGap.Importer.Tests` namespace.
- Implemented `InMemoryBundleRepositories` for testing bundle catalog and item repositories.
- Created `MerkleRootCalculator`, `RootRotationPolicy`, and `TufMetadataValidator` tests.
- Developed `StalenessCalculator` and `TimeAnchorLoader` tests in the `StellaOps.AirGap.Time.Tests` namespace.
- Added `fetch-sbomservice-deps.sh` script for offline dependency fetching.

tests/AirGap/StellaOps.AirGap.Importer.Tests/BundleImportPlannerTests.cs

@@ -0,0 +1,40 @@
+using StellaOps.AirGap.Importer.Contracts;
+using StellaOps.AirGap.Importer.Planning;
+
+namespace StellaOps.AirGap.Importer.Tests;
+
+public class BundleImportPlannerTests
+{
+    [Fact]
+    public void ReturnsFailureWhenBundlePathMissing()
+    {
+        var planner = new BundleImportPlanner();
+        var result = planner.CreatePlan(string.Empty, TrustRootConfig.Empty("/tmp"));
+
+        Assert.False(result.InitialState.IsValid);
+        Assert.Equal("bundle-path-required", result.InitialState.Reason);
+    }
+
+    [Fact]
+    public void ReturnsFailureWhenTrustRootsMissing()
+    {
+        var planner = new BundleImportPlanner();
+        var result = planner.CreatePlan("bundle.tar", TrustRootConfig.Empty("/tmp"));
+
+        Assert.False(result.InitialState.IsValid);
+        Assert.Equal("trust-roots-required", result.InitialState.Reason);
+    }
+
+    [Fact]
+    public void ReturnsDefaultPlanWhenInputsProvided()
+    {
+        var planner = new BundleImportPlanner();
+        var trust = new TrustRootConfig("/tmp/trust.json", new[] { "abc" }, new[] { "ed25519" }, null, null, new Dictionary<string, byte[]>());
+
+        var result = planner.CreatePlan("bundle.tar", trust);
+
+        Assert.True(result.InitialState.IsValid);
+        Assert.Contains("verify-dsse-signature", result.Steps);
+        Assert.Equal("bundle.tar", result.Inputs["bundlePath"]);
+    }
+}

tests/AirGap/StellaOps.AirGap.Importer.Tests/DsseVerifierTests.cs

@@ -0,0 +1,71 @@
+using System.Security.Cryptography;
+using StellaOps.AirGap.Importer.Contracts;
+using StellaOps.AirGap.Importer.Validation;
+
+namespace StellaOps.AirGap.Importer.Tests;
+
+public class DsseVerifierTests
+{
+    [Fact]
+    public void FailsWhenUntrustedKey()
+    {
+        var verifier = new DsseVerifier();
+        var envelope = new DsseEnvelope("text/plain", Convert.ToBase64String("hi"u8), new[] { new DsseSignature("k1", "sig") });
+        var trust = TrustRootConfig.Empty("/tmp");
+
+        var result = verifier.Verify(envelope, trust);
+
+        Assert.False(result.IsValid);
+    }
+
+    [Fact]
+    public void VerifiesRsaPssSignature()
+    {
+        using var rsa = RSA.Create(2048);
+        var pub = rsa.ExportSubjectPublicKeyInfo();
+        var payload = "hello-world";
+        var payloadType = "application/vnd.stella.bundle";
+        var pae = BuildPae(payloadType, payload);
+        var sig = rsa.SignData(pae, HashAlgorithmName.SHA256, RSASignaturePadding.Pss);
+
+        var envelope = new DsseEnvelope(payloadType, Convert.ToBase64String(System.Text.Encoding.UTF8.GetBytes(payload)), new[]
+        {
+            new DsseSignature("k1", Convert.ToBase64String(sig))
+        });
+
+        var trust = new TrustRootConfig(
+            "/tmp/root.json",
+            new[] { Fingerprint(pub) },
+            new[] { "rsassa-pss-sha256" },
+            null,
+            null,
+            new Dictionary<string, byte[]> { ["k1"] = pub });
+
+        var result = new DsseVerifier().Verify(envelope, trust);
+
+        Assert.True(result.IsValid);
+        Assert.Equal("dsse-signature-verified", result.Reason);
+    }
+
+    private static byte[] BuildPae(string payloadType, string payload)
+    {
+        var parts = new[] { "DSSEv1", payloadType, payload };
+        var paeBuilder = new System.Text.StringBuilder();
+        paeBuilder.Append("PAE:");
+        paeBuilder.Append(parts.Length);
+        foreach (var part in parts)
+        {
+            paeBuilder.Append(' ');
+            paeBuilder.Append(part.Length);
+            paeBuilder.Append(' ');
+            paeBuilder.Append(part);
+        }
+
+        return System.Text.Encoding.UTF8.GetBytes(paeBuilder.ToString());
+    }
+
+    private static string Fingerprint(byte[] pub)
+    {
+        return Convert.ToHexString(SHA256.HashData(pub)).ToLowerInvariant();
+    }
+}

tests/AirGap/StellaOps.AirGap.Importer.Tests/ImportValidatorTests.cs

@@ -0,0 +1,92 @@
+using System.Security.Cryptography;
+using StellaOps.AirGap.Importer.Contracts;
+using StellaOps.AirGap.Importer.Validation;
+
+namespace StellaOps.AirGap.Importer.Tests;
+
+public class ImportValidatorTests
+{
+    [Fact]
+    public void FailsWhenTufInvalid()
+    {
+        var request = BuildRequest(rootJson: "{}", snapshotJson: "{}", timestampJson: "{}");
+        var result = new ImportValidator().Validate(request);
+        Assert.False(result.IsValid);
+        Assert.StartsWith("tuf:", result.Reason);
+    }
+
+    [Fact]
+    public void SucceedsWhenAllChecksPass()
+    {
+        var root = "{\"version\":1,\"expiresUtc\":\"2030-01-01T00:00:00Z\"}";
+        var snapshot = "{\"version\":1,\"expiresUtc\":\"2030-01-01T00:00:00Z\",\"meta\":{\"snapshot\":{\"hashes\":{\"sha256\":\"abc\"}}}}";
+        var timestamp = "{\"version\":1,\"expiresUtc\":\"2030-01-01T00:00:00Z\",\"snapshot\":{\"meta\":{\"hashes\":{\"sha256\":\"abc\"}}}}";
+
+        using var rsa = RSA.Create(2048);
+        var pub = rsa.ExportSubjectPublicKeyInfo();
+
+        var payload = "bundle-body";
+        var payloadType = "application/vnd.stella.bundle";
+        var pae = BuildPae(payloadType, payload);
+        var sig = rsa.SignData(pae, HashAlgorithmName.SHA256, RSASignaturePadding.Pss);
+
+        var envelope = new DsseEnvelope(payloadType, Convert.ToBase64String(System.Text.Encoding.UTF8.GetBytes(payload)), new[]
+        {
+            new DsseSignature("k1", Convert.ToBase64String(sig))
+        });
+
+        var trustStore = new TrustStore();
+        trustStore.LoadActive(new Dictionary<string, byte[]> { ["k1"] = pub });
+        trustStore.StagePending(new Dictionary<string, byte[]> { ["k2"] = pub });
+
+        var request = new ImportValidationRequest(
+            envelope,
+            new TrustRootConfig("/tmp/root.json", new[] { Fingerprint(pub) }, new[] { "rsassa-pss-sha256" }, null, null, new Dictionary<string, byte[]> { ["k1"] = pub }),
+            root,
+            snapshot,
+            timestamp,
+            new List<NamedStream> { new("a.txt", new MemoryStream("data"u8.ToArray())) },
+            trustStore,
+            new[] { "approver-1", "approver-2" });
+
+        var result = new ImportValidator().Validate(request);
+
+        Assert.True(result.IsValid);
+        Assert.Equal("import-validated", result.Reason);
+    }
+
+    private static byte[] BuildPae(string payloadType, string payload)
+    {
+        var parts = new[] { "DSSEv1", payloadType, payload };
+        var paeBuilder = new System.Text.StringBuilder();
+        paeBuilder.Append("PAE:");
+        paeBuilder.Append(parts.Length);
+        foreach (var part in parts)
+        {
+            paeBuilder.Append(' ');
+            paeBuilder.Append(part.Length);
+            paeBuilder.Append(' ');
+            paeBuilder.Append(part);
+        }
+
+        return System.Text.Encoding.UTF8.GetBytes(paeBuilder.ToString());
+    }
+
+    private static string Fingerprint(byte[] pub) => Convert.ToHexString(SHA256.HashData(pub)).ToLowerInvariant();
+
+    private static ImportValidationRequest BuildRequest(string rootJson, string snapshotJson, string timestampJson)
+    {
+        var envelope = new DsseEnvelope("text/plain", Convert.ToBase64String("hi"u8), Array.Empty<DsseSignature>());
+        var trustRoot = TrustRootConfig.Empty("/tmp");
+        var trustStore = new TrustStore();
+        return new ImportValidationRequest(
+            envelope,
+            trustRoot,
+            rootJson,
+            snapshotJson,
+            timestampJson,
+            Array.Empty<NamedStream>(),
+            trustStore,
+            Array.Empty<string>());
+    }
+}

tests/AirGap/StellaOps.AirGap.Importer.Tests/InMemoryBundleRepositoriesTests.cs

@@ -0,0 +1,63 @@
+using StellaOps.AirGap.Importer.Models;
+using StellaOps.AirGap.Importer.Repositories;
+
+namespace StellaOps.AirGap.Importer.Tests;
+
+public class InMemoryBundleRepositoriesTests
+{
+    [Fact]
+    public async Task CatalogUpsertOverwritesPerTenant()
+    {
+        var repo = new InMemoryBundleCatalogRepository();
+        var entry1 = new BundleCatalogEntry("t1", "b1", "d1", DateTimeOffset.UnixEpoch, new[] { "a" });
+        var entry2 = new BundleCatalogEntry("t1", "b1", "d2", DateTimeOffset.UnixEpoch.AddMinutes(1), new[] { "b" });
+
+        await repo.UpsertAsync(entry1, default);
+        await repo.UpsertAsync(entry2, default);
+
+        var list = await repo.ListAsync("t1", default);
+        Assert.Single(list);
+        Assert.Equal("d2", list[0].Digest);
+    }
+
+    [Fact]
+    public async Task CatalogIsTenantIsolated()
+    {
+        var repo = new InMemoryBundleCatalogRepository();
+        await repo.UpsertAsync(new BundleCatalogEntry("t1", "b1", "d1", DateTimeOffset.UnixEpoch, Array.Empty<string>()), default);
+        await repo.UpsertAsync(new BundleCatalogEntry("t2", "b1", "d2", DateTimeOffset.UnixEpoch, Array.Empty<string>()), default);
+
+        var t1 = await repo.ListAsync("t1", default);
+        Assert.Single(t1);
+        Assert.Equal("d1", t1[0].Digest);
+    }
+
+    [Fact]
+    public async Task ItemsOrderedByPath()
+    {
+        var repo = new InMemoryBundleItemRepository();
+        await repo.UpsertManyAsync(new[]
+        {
+            new BundleItem("t1", "b1", "b.txt", "d2", 10),
+            new BundleItem("t1", "b1", "a.txt", "d1", 5)
+        }, default);
+
+        var list = await repo.ListByBundleAsync("t1", "b1", default);
+        Assert.Equal(new[] { "a.txt", "b.txt" }, list.Select(i => i.Path).ToArray());
+    }
+
+    [Fact]
+    public async Task ItemsTenantIsolated()
+    {
+        var repo = new InMemoryBundleItemRepository();
+        await repo.UpsertManyAsync(new[]
+        {
+            new BundleItem("t1", "b1", "a.txt", "d1", 1),
+            new BundleItem("t2", "b1", "a.txt", "d2", 1)
+        }, default);
+
+        var list = await repo.ListByBundleAsync("t1", "b1", default);
+        Assert.Single(list);
+        Assert.Equal("d1", list[0].Digest);
+    }
+}

tests/AirGap/StellaOps.AirGap.Importer.Tests/MerkleRootCalculatorTests.cs

@@ -0,0 +1,28 @@
+using StellaOps.AirGap.Importer.Validation;
+
+namespace StellaOps.AirGap.Importer.Tests;
+
+public class MerkleRootCalculatorTests
+{
+    [Fact]
+    public void EmptySetProducesEmptyRoot()
+    {
+        var calc = new MerkleRootCalculator();
+        var root = calc.ComputeRoot(Array.Empty<NamedStream>());
+        Assert.Equal(string.Empty, root);
+    }
+
+    [Fact]
+    public void DeterministicAcrossOrder()
+    {
+        var calc = new MerkleRootCalculator();
+        var a = new NamedStream("b.txt", new MemoryStream("two"u8.ToArray()));
+        var b = new NamedStream("a.txt", new MemoryStream("one"u8.ToArray()));
+
+        var root1 = calc.ComputeRoot(new[] { a, b });
+        var root2 = calc.ComputeRoot(new[] { b, a });
+
+        Assert.Equal(root1, root2);
+        Assert.NotEqual(string.Empty, root1);
+    }
+}

tests/AirGap/StellaOps.AirGap.Importer.Tests/RootRotationPolicyTests.cs

@@ -0,0 +1,40 @@
+using StellaOps.AirGap.Importer.Validation;
+
+namespace StellaOps.AirGap.Importer.Tests;
+
+public class RootRotationPolicyTests
+{
+    [Fact]
+    public void RequiresTwoApprovers()
+    {
+        var policy = new RootRotationPolicy();
+        var result = policy.Validate(new Dictionary<string, byte[]>(), new Dictionary<string, byte[]> { ["k1"] = new byte[] { 1 } }, new[] { "a" });
+        Assert.False(result.IsValid);
+        Assert.Equal("rotation-dual-approval-required", result.Reason);
+    }
+
+    [Fact]
+    public void RejectsNoChange()
+    {
+        var policy = new RootRotationPolicy();
+        var result = policy.Validate(
+            new Dictionary<string, byte[]> { ["k1"] = new byte[] { 1 } },
+            new Dictionary<string, byte[]> { ["k1"] = new byte[] { 1 } },
+            new[] { "a", "b" });
+        Assert.False(result.IsValid);
+        Assert.Equal("rotation-no-change", result.Reason);
+    }
+
+    [Fact]
+    public void AcceptsRotationWithDualApproval()
+    {
+        var policy = new RootRotationPolicy();
+        var result = policy.Validate(
+            new Dictionary<string, byte[]> { ["old"] = new byte[] { 1 } },
+            new Dictionary<string, byte[]> { ["new"] = new byte[] { 2 } },
+            new[] { "a", "b" });
+
+        Assert.True(result.IsValid);
+        Assert.Equal("rotation-approved", result.Reason);
+    }
+}

tests/AirGap/StellaOps.AirGap.Importer.Tests/StellaOps.AirGap.Importer.Tests.csproj

@@ -0,0 +1,16 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <IsPackable>false</IsPackable>
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>enable</ImplicitUsings>
+  </PropertyGroup>
+  <ItemGroup>
+    <PackageReference Include="xunit" Version="2.9.2" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="2.8.2" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.10.0" />
+  </ItemGroup>
+  <ItemGroup>
+    <ProjectReference Include="../../../src/AirGap/StellaOps.AirGap.Importer/StellaOps.AirGap.Importer.csproj" />
+  </ItemGroup>
+</Project>

tests/AirGap/StellaOps.AirGap.Importer.Tests/TufMetadataValidatorTests.cs

@@ -0,0 +1,42 @@
+using StellaOps.AirGap.Importer.Validation;
+
+namespace StellaOps.AirGap.Importer.Tests;
+
+public class TufMetadataValidatorTests
+{
+    [Fact]
+    public void RejectsInvalidJson()
+    {
+        var validator = new TufMetadataValidator();
+        var result = validator.Validate("{}", "{}", "{}");
+        Assert.False(result.IsValid);
+    }
+
+    [Fact]
+    public void AcceptsConsistentSnapshotHash()
+    {
+        var validator = new TufMetadataValidator();
+        var root = "{\"version\":1,\"expiresUtc\":\"2030-01-01T00:00:00Z\"}";
+        var snapshot = "{\"version\":1,\"expiresUtc\":\"2030-01-01T00:00:00Z\",\"meta\":{\"snapshot\":{\"hashes\":{\"sha256\":\"abc\"}}}}";
+        var timestamp = "{\"version\":1,\"expiresUtc\":\"2030-01-01T00:00:00Z\",\"snapshot\":{\"meta\":{\"hashes\":{\"sha256\":\"abc\"}}}}";
+
+        var result = validator.Validate(root, snapshot, timestamp);
+
+        Assert.True(result.IsValid);
+        Assert.Equal("tuf-metadata-valid", result.Reason);
+    }
+
+    [Fact]
+    public void DetectsHashMismatch()
+    {
+        var validator = new TufMetadataValidator();
+        var root = "{\"version\":1,\"expiresUtc\":\"2030-01-01T00:00:00Z\"}";
+        var snapshot = "{\"version\":1,\"expiresUtc\":\"2030-01-01T00:00:00Z\",\"meta\":{\"snapshot\":{\"hashes\":{\"sha256\":\"abc\"}}}}";
+        var timestamp = "{\"version\":1,\"expiresUtc\":\"2030-01-01T00:00:00Z\",\"snapshot\":{\"meta\":{\"hashes\":{\"sha256\":\"def\"}}}}";
+
+        var result = validator.Validate(root, snapshot, timestamp);
+
+        Assert.False(result.IsValid);
+        Assert.Equal("tuf-snapshot-hash-mismatch", result.Reason);
+    }
+}

tests/AirGap/StellaOps.AirGap.Time.Tests/StalenessCalculatorTests.cs

@@ -0,0 +1,43 @@
+using StellaOps.AirGap.Time.Models;
+using StellaOps.AirGap.Time.Services;
+
+namespace StellaOps.AirGap.Time.Tests;
+
+public class StalenessCalculatorTests
+{
+    [Fact]
+    public void UnknownWhenNoAnchor()
+    {
+        var calc = new StalenessCalculator();
+        var result = calc.Evaluate(TimeAnchor.Unknown, StalenessBudget.Default, DateTimeOffset.UnixEpoch);
+        Assert.False(result.IsWarning);
+        Assert.False(result.IsBreach);
+    }
+
+    [Fact]
+    public void BreachWhenBeyondBudget()
+    {
+        var anchor = new TimeAnchor(DateTimeOffset.UnixEpoch, "source", "fmt", "fp", "digest");
+        var budget = new StalenessBudget(10, 20);
+        var calc = new StalenessCalculator();
+
+        var result = calc.Evaluate(anchor, budget, DateTimeOffset.UnixEpoch.AddSeconds(25));
+
+        Assert.True(result.IsBreach);
+        Assert.True(result.IsWarning);
+        Assert.Equal(25, result.AgeSeconds);
+    }
+
+    [Fact]
+    public void WarningWhenBetweenWarningAndBreach()
+    {
+        var anchor = new TimeAnchor(DateTimeOffset.UnixEpoch, "source", "fmt", "fp", "digest");
+        var budget = new StalenessBudget(10, 20);
+        var calc = new StalenessCalculator();
+
+        var result = calc.Evaluate(anchor, budget, DateTimeOffset.UnixEpoch.AddSeconds(15));
+
+        Assert.True(result.IsWarning);
+        Assert.False(result.IsBreach);
+    }
+}

tests/AirGap/StellaOps.AirGap.Time.Tests/StellaOps.AirGap.Time.Tests.csproj

@@ -0,0 +1,16 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <IsPackable>false</IsPackable>
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>enable</ImplicitUsings>
+  </PropertyGroup>
+  <ItemGroup>
+    <PackageReference Include="xunit" Version="2.9.2" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="2.8.2" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.10.0" />
+  </ItemGroup>
+  <ItemGroup>
+    <ProjectReference Include="../../../src/AirGap/StellaOps.AirGap.Time/StellaOps.AirGap.Time.csproj" />
+  </ItemGroup>
+</Project>

tests/AirGap/StellaOps.AirGap.Time.Tests/TimeAnchorLoaderTests.cs

@@ -0,0 +1,28 @@
+using StellaOps.AirGap.Time.Parsing;
+using StellaOps.AirGap.Time.Services;
+
+namespace StellaOps.AirGap.Time.Tests;
+
+public class TimeAnchorLoaderTests
+{
+    [Fact]
+    public void RejectsInvalidHex()
+    {
+        var loader = new TimeAnchorLoader();
+        var result = loader.TryLoadHex("not-hex", TimeTokenFormat.Roughtime, Array.Empty<TimeTrustRoot>(), out _);
+        Assert.False(result.IsValid);
+        Assert.Equal("token-hex-invalid", result.Reason);
+    }
+
+    [Fact]
+    public void LoadsHexToken()
+    {
+        var loader = new TimeAnchorLoader();
+        var hex = "01020304";
+        var trust = new[] { new TimeTrustRoot("k1", new byte[] { 0x01 }, "rsassa-pss-sha256") };
+        var result = loader.TryLoadHex(hex, TimeTokenFormat.Roughtime, trust, out var anchor);
+
+        Assert.True(result.IsValid);
+        Assert.Equal("Roughtime", anchor.Format);
+    }
+}

tests/AirGap/StellaOps.AirGap.Time.Tests/TimeStatusDtoTests.cs

@@ -0,0 +1,20 @@
+using StellaOps.AirGap.Time.Models;
+
+namespace StellaOps.AirGap.Time.Tests;
+
+public class TimeStatusDtoTests
+{
+    [Fact]
+    public void SerializesDeterministically()
+    {
+        var status = new TimeStatus(
+            new TimeAnchor(DateTimeOffset.Parse("2025-01-01T00:00:00Z"), "source", "fmt", "fp", "digest"),
+            new StalenessEvaluation(42, 10, 20, true, false),
+            new StalenessBudget(10, 20),
+            DateTimeOffset.Parse("2025-01-02T00:00:00Z"));
+
+        var json = TimeStatusDto.FromStatus(status).ToJson();
+
+        Assert.Equal("{\"anchorTime\":\"2025-01-01T00:00:00.0000000Z\",\"format\":\"fmt\",\"source\":\"source\",\"fingerprint\":\"fp\",\"digest\":\"digest\",\"ageSeconds\":42,\"warningSeconds\":10,\"breachSeconds\":20,\"isWarning\":true,\"isBreach\":false,\"evaluatedAtUtc\":\"2025-01-02T00:00:00.0000000Z\"}", json);
+    }
+}

tests/AirGap/StellaOps.AirGap.Time.Tests/TimeStatusServiceTests.cs

@@ -0,0 +1,34 @@
+using StellaOps.AirGap.Time.Models;
+using StellaOps.AirGap.Time.Services;
+using StellaOps.AirGap.Time.Stores;
+
+namespace StellaOps.AirGap.Time.Tests;
+
+public class TimeStatusServiceTests
+{
+    [Fact]
+    public async Task ReturnsUnknownWhenNoAnchor()
+    {
+        var svc = Build();
+        var status = await svc.GetStatusAsync("t1", DateTimeOffset.UnixEpoch);
+        Assert.Equal(TimeAnchor.Unknown, status.Anchor);
+        Assert.False(status.Staleness.IsWarning);
+    }
+
+    [Fact]
+    public async Task PersistsAnchorAndBudget()
+    {
+        var svc = Build();
+        var anchor = new TimeAnchor(DateTimeOffset.UnixEpoch, "source", "fmt", "fp", "digest");
+        var budget = new StalenessBudget(10, 20);
+
+        await svc.SetAnchorAsync("t1", anchor, budget);
+        var status = await svc.GetStatusAsync("t1", DateTimeOffset.UnixEpoch.AddSeconds(15));
+
+        Assert.Equal(anchor, status.Anchor);
+        Assert.True(status.Staleness.IsWarning);
+        Assert.False(status.Staleness.IsBreach);
+    }
+
+    private static TimeStatusService Build() => new(new InMemoryTimeAnchorStore(), new StalenessCalculator());
+}

tests/AirGap/StellaOps.AirGap.Time.Tests/TimeTokenParserTests.cs

@@ -0,0 +1,34 @@
+using StellaOps.AirGap.Time.Models;
+using StellaOps.AirGap.Time.Parsing;
+
+namespace StellaOps.AirGap.Time.Tests;
+
+public class TimeTokenParserTests
+{
+    [Fact]
+    public void EmptyTokenFails()
+    {
+        var parser = new TimeTokenParser();
+        var result = parser.TryParse(Array.Empty<byte>(), TimeTokenFormat.Roughtime, out var anchor);
+
+        Assert.False(result.IsValid);
+        Assert.Equal("token-empty", result.Reason);
+        Assert.Equal(TimeAnchor.Unknown, anchor);
+    }
+
+    [Fact]
+    public void RoughtimeTokenProducesDigest()
+    {
+        var parser = new TimeTokenParser();
+        var token = new byte[] { 0x01, 0x02, 0x03 };
+
+        var result = parser.TryParse(token, TimeTokenFormat.Roughtime, out var anchor);
+
+        Assert.True(result.IsValid);
+        Assert.Equal("Roughtime", anchor.Format);
+        Assert.Equal("roughtime-token", anchor.Source);
+        Assert.Equal("structure-stubbed", result.Reason);
+        Assert.Matches("^[0-9a-f]{64}$", anchor.TokenDigest);
+        Assert.NotEqual(DateTimeOffset.UnixEpoch, anchor.AnchorTime); // deterministic derivation
+    }
+}

tests/AirGap/StellaOps.AirGap.Time.Tests/TimeVerificationServiceTests.cs

@@ -0,0 +1,28 @@
+using StellaOps.AirGap.Time.Models;
+using StellaOps.AirGap.Time.Parsing;
+using StellaOps.AirGap.Time.Services;
+
+namespace StellaOps.AirGap.Time.Tests;
+
+public class TimeVerificationServiceTests
+{
+    [Fact]
+    public void FailsWithoutTrustRoots()
+    {
+        var svc = new TimeVerificationService();
+        var result = svc.Verify(new byte[] { 0x01 }, TimeTokenFormat.Roughtime, Array.Empty<TimeTrustRoot>(), out _);
+        Assert.False(result.IsValid);
+        Assert.Equal("trust-roots-required", result.Reason);
+    }
+
+    [Fact]
+    public void SucceedsForRoughtimeWithTrustRoot()
+    {
+        var svc = new TimeVerificationService();
+        var trust = new[] { new TimeTrustRoot("k1", new byte[] { 0x01 }, "rsassa-pss-sha256") };
+        var result = svc.Verify(new byte[] { 0x01, 0x02 }, TimeTokenFormat.Roughtime, trust, out var anchor);
+        Assert.True(result.IsValid);
+        Assert.Equal("Roughtime", anchor.Format);
+        Assert.Equal("k1", anchor.SignatureFingerprint);
+    }
+}